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Amendments to the Claims : 

A listing of the entire set of pending claims (including amendments to the claims, 
if any) is submitted herewith per 37 CFR §1.121. This listing of claims will replace all 
prior versions, and listings, of claims in the appHcation. 

Listing of Claims 

This listing of claims will replace all prior versions, and listings, of claims in the 
appUcation: 

1 . (Currently Amended) A method for detecting maUcious scripts 
using a static analysis, comprising the step of: 

checking a script to determine whether a series of methods constructing a 
malicious code pattem exist and whether parameters and return values associated between 
the methods that satisfy a generated matching rule m atch each other, 
wherein the checking step comprises the steps of: 

a) classifying, by modeUng a malicious behavior to include unit behaviors 
each of which is composed of sub-unit behaviors or one or more method calls, 

b) generating [[a]] the matching rule by converting each identified unit 
behavior and method call sentence into said matching rule for defining sentence types to 
be detected in script codes, said matching rule comprising rule identifiers and sentence 
pattems to be detected and 

c) generating at least one relation rule for defining a relation 
between rule variables used in the sentences satisfying the matching rule by analyzing a 
relation between the rule identifiers used in the sentences pattems satisfying the matching 
mle: 

d) generating a set of instances of the matching rule by: 

i) searching for code pattems matched with the matching 
rule from a relevant script code to be detected, 

ii) extracting parameters of functions used in the searched 
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code patterns; and 

iii) storing the extracted parameters in the rule variables; and 
e) generating instances of the relation rule by searching for instances of the 
matching rule satisfying the relation rule from the set of the generated instances of the 
matching rule through a relation analysis process by continuously checking whether 
previously generated instances of the relation rule associated with a currently generated 
instance of the relation rule are satisfied . 

2. (Previously Presented) The method according to claim 1, wherein the 
matching rule and sentence pattems have the same grammar as a language of the scripts 
to be detected. 

3. (Original) The method according to claim 2, wherein the relation rule further 
includes preconditions (Precond) in which conditions that should be satisfied prior to the 
conditions in the conditional expressions are described, and the action expressions 
describe contents that will be executed when both the conditional expressions and the 
preconditions are satisfied. 

4. (Previously Presented) The method according to claim 1, further comprising the 
step of converting the script into a format suitable for static analysis, 

5. (Previously Presented) The method according to claim 1, further comprising the 
step of reporting identified instances of the matching rule and relation rule in a result 
report process. 

6. (Previously Presented) The method according to claim 1, wherein the relation 
rule comprises conditional expressions (Cond) in which conditions satisfying the relevant 
rule are described, and action expressions (Action) in which contents to be executed are 
described when the conditions in the conditional expressions are satisfied. 
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